Ex-Meta staff sues over WhatsApp cybersecurity failures

A former Meta employee has filed a lawsuit in the US District Court for the Northern District of California, alleging cybersecurity failures at WhatsApp that could put user privacy at risk.

Attaullah Baig, who served as WhatsApp’s head of security after joining in 2021, claims he found security flaws that violated federal securities laws and Meta’s obligations under a 2020 FTC privacy settlement.

He alleges that about 1,500 WhatsApp engineers had unrestricted access to user data and reported these issues to Meta leadership, including CEO Mark Zuckerberg, and later to the SEC.

Baig says he began receiving negative performance reviews soon after his disclosures and was terminated in February 2025 during company layoffs.

Meta has disputed his allegations and downplayed his role, saying he was dismissed for poor performance.

The lawsuit does not allege actual user data was compromised.

🔗 Source: CNBC

🧠 Food for thought

Implications, context, and why it matters.

Meta’s recurring security challenges highlight persistent data access vulnerabilities

Baig’s allegations about 1,500 WhatsApp engineers having unrestricted access to user data echo Meta’s documented history of security lapses across its platforms.
The Cambridge Analytica scandal in 2018 exposed how over 50 million Facebook profiles were harvested without user consent, demonstrating similar issues with data access controls and oversight.
That same year, Meta disclosed a separate security vulnerability affecting 30 million users, where attackers exploited the “View As” feature from July 2017 to September 2018, accessing personal information including names, contact details, and profile data.
The recurring pattern suggests that despite previous incidents and regulatory settlements, Meta continues to face challenges in implementing robust internal data access controls.
Baig’s claims about WhatsApp lacking proper audit trails for data access mirror the oversight gaps that enabled previous breaches, indicating these may be structural rather than isolated issues.

Whistleblower retaliation allegations follow predictable corporate response patterns

Meta’s response to Baig’s claims, disputing his allegations while downplaying his role and citing “poor performance,” reflects a common corporate strategy when facing whistleblower lawsuits.
The timeline Baig describes shows escalating retaliation: negative performance feedback within three days of his initial disclosure, followed by termination during February layoffs affecting 5% of staff.
His legal strategy of filing complaints with multiple agencies—SEC in November, then OSHA in January—before going to court demonstrates the administrative hurdles whistleblowers must navigate before pursuing civil litigation.
The 2020 FTC privacy settlement that Baig claims Meta violated adds regulatory weight to his allegations, as violations of consent decrees can trigger significant penalties and enforcement actions.